Data centre security: physical access, zones and logging

1. Perimeter: fence, vehicle gate, a check before anyone reaches the building.
2. Building entrance: security reception, identity check, credential issued.
3. Interior: corridors, loading areas and offices, with access by role.
4. Data halls: a restricted list, controlled entry one person at a time.
5. Customer cabinets or cages: locked, open only to the people each customer names.

Critical support spaces — electrical rooms, generators, cooling, carrier rooms — get a zone of their own, because a fault there stops everything. Many clients audit physical security against their own standards; ask in writing, from the start, which requirements apply to the guarding, so the record can evidence them.

1. The client or site operator approves in advance who is coming, when, and to which zones.
2. At the entrance, the officer checks an identity document against the list.
3. A credential is issued only for the approved zones and the approved period.
4. Anything that doesn’t match — another day, another zone, an unknown person — stops and is confirmed with the client’s contact.
5. On exit, the credential is returned and the departure is logged.

The officer doesn’t decide who is authorised. They verify against what the client has approved in writing, and log every exception.

In the corporate buildings OVIT protects, reception, the host and security share one controlled request, and the officer issues, limits or declines access with the full context (enterprise security).

• Work order: what job, which zone, which cabinet, what hours, who approved it.
• Escort: named in advance, stays with the visitor and never leaves them alone in a data hall.
• Equipment: whatever comes in and goes out — tools, devices, storage media — is logged under the client’s procedure.
• Deliveries: received at the loading area and checked against the expected shipment before anything enters the inner zones.

Escort fails when nobody is clearly responsible. Write it into the post orders: who escorts, what they do if the visitor asks to go elsewhere, and whom they tell.

• Mantrap: the second door opens only once the first has closed and the person is verified.
• Turnstile: one passage per credential, usually at the building entrance.
• Anti-passback: a credential won’t reopen the same entry unless an exit was recorded.
• Door alarms: a door held open or forced alerts someone who answers, at once.

Every physical barrier generates alarms. If nobody answers them, doors get propped open and the system loses its value.

• Access: who, when, which zone, which credential, on whose approval.
• Visitors: work order, escort, times in and out, equipment.
• Exceptions: what didn’t match, who was told, who decided.
• Alarms: doors, forced entry, tailgating, and the action that followed.
• Periodic review: active credentials compared with the client’s list, so those no longer needed are revoked.

Video has limits: delete within 15 working days at most if nothing happens; footage of an incident against the business may be kept up to 30 days, and of one involving a third party up to 3 months (Directive 1/2011, art. 8). Signs go up before the camera’s field of view (art. 12). The Hellenic Data Protection Authority states that CCTV may not be used to monitor or evaluate employees (art. 27, Law 4624/2019). More in the guide to CCTV and GDPR.

• Door forced or held open: attend, check the zone, report, log.
• Unknown person in a zone: verify, escort out of the zone, inform the client.
• Tailgating: locate the person, verify, report.
• Evacuation alarm: the building’s evacuation procedure, with a headcount at the assembly point.
• Medical emergency: call for help and guide responders through the controlled zones.

OVIT runs drilled response playbooks for fire, medical and intrusion scenarios, with liaison with first responders arranged in advance, and a real person answers the operations desk. The client sees incidents and reports in one live picture through the Guardly platform.

Everyone on the shift holds a personal work licence, category A or B, valid five years (Law 2518/1997, art. 3) — ask for the numbers. The structure of a report is covered in the incident report guide. Request a proposal for your data centre.